diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2013-12-16 12:04:36 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-01-09 12:24:23 -0800 |
| commit | 6646ce885ff19da84a20193b1b36629f7953305a (patch) | |
| tree | 209af9d4c83ba64c7c3301c7dd4b0dc15dd2d485 /net/wireless/reg.c | |
| parent | 4e7255f33a03b219d76b32b7e7e1cb395004668a (diff) | |
radiotap: fix bitmap-end-finding buffer overrun
commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.
Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/wireless/reg.c')
0 files changed, 0 insertions, 0 deletions